#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void test()
{
    system("/bin/sh");
}

int main()
{
    char buf[20];
    gets(buf);
    return 0;
}

#if 0

gcc -fno-stack-protector -z execstack -z norelro -no-pie ret2text.c -o ret2text


cyclic 100
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaa

pwndbg> c
Continuing.
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab

Program received signal SIGSEGV, Segmentation fault.
0x0000000000401190 in main ()
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
*RAX  0
 RBX  0x4011a0 (__libc_csu_init) ◂— endbr64 
*RCX  0x7ffff7fa7980 (_IO_2_1_stdin_) ◂— mov byte ptr [rdx], ah /* 0xfbad2288 */
*RDX  0
*RDI  0x7ffff7fa97f0 (_IO_stdfile_0_lock) ◂— 0
*RSI  0x4042a1 ◂— 0x6361616162616161 ('aaabaaac')
*R8   0x7fffffffde80 ◂— 0x6161616261616161 ('aaaabaaa')
*R9   0
*R10  0x7ffff7fa7be0 (main_arena+96) —▸ 0x4046a0 ◂— 0
*R11  0x246
 R12  0x401070 (_start) ◂— endbr64 
 R13  0x7fffffffdf90 ◂— 1
 R14  0
 R15  0
*RBP  0x6161616a61616169 ('iaaajaaa')
 RSP  0x7fffffffdea8 ◂— 'kaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
*RIP  0x401190 (main+35) ◂— ret 
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0x40117d <main+16>    mov    rdi, rax              RDI => 0x7fffffffde80 ◂— 0
   0x401180 <main+19>    mov    eax, 0                EAX => 0
   0x401185 <main+24>    call   gets@plt                    <gets@plt>
 
   0x40118a <main+29>    mov    eax, 0                EAX => 0
   0x40118f <main+34>    leave  
 ► 0x401190 <main+35>    ret                                <0x6161616c6161616b>
    ↓



─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffffdea8 ◂— 'kaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
01:0008│     0x7fffffffdeb0 ◂— 'maaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
02:0010│     0x7fffffffdeb8 ◂— 'oaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
03:0018│     0x7fffffffdec0 ◂— 'qaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
04:0020│     0x7fffffffdec8 ◂— 'saaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
05:0028│     0x7fffffffded0 ◂— 'uaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
06:0030│     0x7fffffffded8 ◂— 'waaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
07:0038│     0x7fffffffdee0 ◂— 'yaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0         0x401190 main+35
   1 0x6161616c6161616b
   2 0x6161616e6161616d
   3 0x616161706161616f
   4 0x6161617261616171
   5 0x6161617461616173
   6 0x6161617661616175
   7 0x6161617861616177
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> quit


cyclic -l 0x6161616c6161616b
40


#endif

